Am I affected by @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name? What should I do?
Several Hulumi policy rules used the URN to grant exemptions.
Affected: @hulumi/policies < 1.4.0. Fixed in: 1.4.0. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-48033-hulumi-policies (opens external site)
1 answer
Am I affected? Affected: @hulumi/policies < 1.4.0. Fixed in: 1.4.0.
- Check your version: run
npm ls @hulumi/policies. Versions < 1.4.0 of @hulumi/policies are affected.
What to do now
- Upgrade to the fixed version: run
npm install @hulumi/policies@1.4.0(first patched version 1.4.0). - Upgrade to
@hulumi/policies@1.4.0. - No reliable workaround is available — a local lint that rejects logical names containing
$would catch the trivial form of the spoof but not crafted variants.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-rhgj-6g2c-frmm (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-48033-hulumi-policies (opens external site)
Did this work for you?- Check your version: run